The Defender's Guide to Agentic AI: Navigating Vulnerabilities, The Lethal Trifecta, and Endpoint Defense (2023-2026)

Published: 3 August 2026

1. Introduction: The 2023-2026 Evolution of AI Vulnerabilities

The security landscape has shifted from the primitive copy-paste data into a box of 2023, where the primary concern was simple data loss to ChatGPT, to the high-consequence era of autonomous AI agents in 2026. We have moved beyond managing what a user types and entered the phase of host-based exposure, where risk is defined by what an agent does on behalf of its operator, often with direct system-level access.

Central to this evolution is what this paper terms the Helpfulness-Capability Gap: the widening architectural gap between an agent’s perceived "helpfulness" and its actual "capability depth." While users view agents as productivity multipliers, architects must view them as autonomous execution engines with a high degree of exposure. We are currently navigating the "Golden Age of host-based agentic AI," characterised by agents executing locally on the OS, mounting network drives, and accessing sensitive local file paths. While an "Industrialised Cloud Future" of managed ecosystems is on the horizon, the enterprise endpoint remains the primary friction point and the most critical visibility gap.

Core Security Transition (2023 vs. 2026):

• From Input to Action: The threat focus has pivoted from the content of a user’s prompt to the multi-step execution chain an agent performs.
• From Direct Leakage to Orchestrated Brokerage: Moving from simple data copy-pasting to agents brokering sensitive internal data between local systems and external platforms.
• From Human Speed to Autonomous Persistence: Agents operate 24/7 without intervention, compressing the Insider Threat Kill Chain. [3]
• From Interaction to Obfuscation: AI activity now intentionally blends into standard endpoint noise, requiring behavioural intelligence to de-mask.

2. Analysis of Five Key AI Security Risks

The transition to agentic workflows has birthed five distinct risk profiles that bypass traditional DLP and content inspection.

3. The 'Lethal Trifecta' and AI Agent Risk Profiling

To manage agentic AI risk, security practitioners must evaluate these systems against the Lethal Trifecta. [1]

• Access to sensitive data: whether installed with organisational approval or not, an agentic AI system typically inherits all access the user has.
• Ability to communicate externally: Agentic AI will most likely have a communication path out to the LLM it is using. Very few endpoint agentic AI frameworks use local LLMs. Then since its general work purpose requires things like checking and managing user emails this gives it further communication power.
• Exposure to untrusted content: There are many ways an AI agent will be exposed but the minimum is always going to be the user’s prompt. This is because we’re assuming worst case scenario that the user is actually a malicious insider.

Once the lethal trifecta has been assessed then the volatile intersection of Autonomy, Capability, and Control Lineage can be reviewed for further risk profiling the Agentic AI.

Risk Profiling Checklist [2]

• Autonomy Level: Does the agent request permission for high-risk actions (e.g., deleting files, modifying logs), or does it execute unilaterally?
• Capability Set: What specific interactions can it perform? Does it have the ability to call external APIs, mount host directories, or invoke PowerShell?
• Control Lineage: Define the authority chain. Who—or what—authorised the agent to access specific sensitive directories, such as /root? Identifying the source of the instruction is critical for establishing intent.
• Observed Behavioural Pattern: Does the agent's execution align with its original instruction set, or is it showing signs of autonomous drift or malicious optimisation?

4. Technical Deep Dive: Detecting Agentic AI on Endpoints Today

Detection strategies must differentiate between deployment models, but as an architect, you must recognise the Orchestration Visibility Paradox.

The Orchestration Visibility Paradox While activity inside a container is often opaque to the host forwarder, containerised deployments (NemoClaw/NanoClaw) frequently produce clearer host telemetry. This is because the orchestration layer—including Claude Code, Telegram bridges, SSH tunnels, and OpenShell—runs on the host OS, generating visible process telemetry that traditional host-level Node processes (which are long-lived and spawn few shells) often lack.

Technical Detection Indicators [2]

1. Build and Setup: Monitor for git clone activity related to NanoClaw or the creation of Dockerfile-based sandboxes. Flag the use of OpenShell server management for NemoClaw-specific sandbox operations.
2. Credential Exposure: Identify API keys (e.g., NVIDIA_API_KEY) being passed as process parameters. These insecure mechanisms are common in agentic projects and lead to credentials being stored in immutable logs or harvested by other agents.
3. Instruction Routing: Detect local network connections where user instructions route from external channels (Telegram/WhatsApp) to local agent nodes. Specifically, the OpenClaw -m (message) flag captures full message content in process parameters, providing visibility superior to standard HTTP inspection.
4. Network Architecture: Monitor for persistent outbound connections on:
   • Port 11434: Ollama LLM inference.
   • Port 3128: Unsanctioned HTTP proxy traffic.

5. BehaviouralDetection and Forensic Signals [2]

Most concerns around Agentic AI today deal with prompt injections that will get the AI to perform actions that go against the guardrails in place. This is a good defense strategy but if it’s the only focus then it is a shortsighted one. [4]

There are plenty of use cases to be considered where the Agentic AI is doing exactly what it should be doing and is arguably within its guardrails. Then the question should be can the organisation effectively monitor not only the input and the intended output but also the behavioural steps of the agentic AI and all the outputs even when they are unexpected.

Furthermore Agentic AI guardrails can be thought of protection for the user to misuse the AI and not the same for AI itself. Often the AI has an overconfidence in its own ability and the drive for it to complete its tasking often outweighs any “security” guardrails put in place.

Both in the media and in the research I have observed and performed, Agentic AI will often go against explicit instructions and perform an action, like downloading a critically vulnerable library, to achieve its task. This action is also non-deterministic [1] so even if you were to task it on deployment and it passed there is no guarantee it would fail in subsequent runs.

Thus treating Agentic AI like an insider and monitoring its behaviour is the only viable option to confirm it is performing within bounds of expectations. This can include:

• initial prompts and decisions input throughout execution by the human
• tools it is downloading and utilising
• communications it is making including internal thoughts and reasoning
• changes made to system files.

The forensic signals can then be useful when identifying new Agentic AI especially in a rapidly growing and changing market.

1. Spawned Process Bursts: Rapid execution of multiple sub-processes at non-human speeds.
   • Threat Hunt: Search for command-line utility bursts occurring in sub-second intervals.
2. Interpreter-Driven Process Chains: Processes originating from Python, Node.js, or PowerShell.
   • Threat Hunt: Map process trees where an interpreter is the parent of powershell.exe or bash and then running reconnaissance or aggregation commands.
3. Machine-Only Activity: High system activity in the absence of user signals.
   • Threat Hunt: Correlate high CPU/IO activity with the absolute absence of mouse and keyboard inputs.
4. Automation Flags: Command-line arguments indicating non-human control.
   • Threat Hunt: Flag processes running with --agent, --local, or specific --session-id strings.
5. Repetitive Network Cadence: Rhythmic outbound API calls to LLM domains.
   • Threat Hunt:Analyse logs for fixed-interval heartbeats to api.fellou.ai or chatgpt.com.
6. I/O Bursts: Mass surges in file modification without an obvious manual trigger.
   • Threat Hunt: Investigate sudden spikes in mass renaming, compression (e.g., PowerShell compression of sensitive directories), or the download of external DLLs with RCE vulnerabilities used for covert encryption.

This still refers back to forensic principals of known what is normal to hunt what is different.

6. Strategic Mitigations: The Defense-in-Depth Framework

Organisations must first implement monitoring in order to gain the visibility to make informed decisions around their programs.

1. Agentic AI Monitoring: There are multiple requirements needed for this to be successful especially when the Agentic AI is being installed legitimately within an organisation.
   • Prompt inputs: The user prompts both initial and throughout the execution will need to be monitored as a means of assessing intent of execution.
   • Agentic AI thoughts: The agents will often show the stream of thoughts which again gives insight into potentially actions being made and discovering why some guardrails might be being ignored.
   • Surrounding file system activity: File downloads, uploads, modifications, permission changes can all be reviewed to assess whether the Agent is performing the intent from the prompt.
   • Network activity: The expected channels should be monitored but also if additional tunnels are established which could indicate data exfiltration or a persistence mechanism which could be abused at a later date.
2. Behavioural Monitoring & Baselines: Establish separate behavioural baselines for "User" vs. "Agent" roles. Use analytics to alert when an agent deviates from its scripted role to access data transfer tools or explore directories outside its validated scope. This is not only useful for insider threats but also for establishing when a valid account may be taken over by an external threat actor.
3. “Patching” Agentic AI: If organisations do install a local LLM then there could arise an issue where an older version persists and there are discovered prompt injections against it which can be abused. In general newer LLMs are more secure and aware of guardrails being manipulated.

7. Conclusion: The Future of Risk-Adaptive Security

Navigating the 2026 and beyond threat landscape requires the unification of human, data, and AI risk management. While agentic AI paths are not always straightforward, they are highly repeatable. By focusing on the forensic evidence of the Insider Threat Kill Chain and Agentic AI behavioural data organisations can better prepare themselves against the risks presented.

While Agentic AI does present a new dimension to risk it is not the first time the industry has faced something like this. It joins a long list of innovations that defenders have dealt with in the past: computers, printers, USB, the internet, personal web mail, and remote access.

References

1. Willison, S. (2025, June 16). The lethal trifecta for AI agents: private data, untrusted content, and external communication. Simon Willison's Weblog. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/​
2. DTEX i³ Research Team. (2026, April 26). i³ Threat Advisory: Detecting Agentic AI on Endpoints Before Data Exfiltration. DTEX. https://www.dtex.ai/resources/i³-threat-advisory-detecting-agentic-ai-on-endpoints-before-data-exfiltration/​
3. DTEX i³ Research Team. (2026, April 24). i³ Threat Advisory: AI-enabled Insider Executes Full Insider Threat Kill Chain. DTEX. https://www.dtex.ai/resources/i3-threat-advisory-ai-insider-executes-full-kill-chain/​
4. DTEX i³ Research Team. (2026, June 14). i³ Threat Advisory: Detecting and Preventing AI Agent Prompt Injection Risks. DTEX. https://www.dtex.ai/resources/i3-threat-advisory-ai-agent-prompt-injection-risks/​
5. DTEX. (2026). Exposing DPRK's Cyber Syndicate and Hidden IT Workforce [Report]. DTEX. https://reports.dtex.ai/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf​